Bootstrap the cluster

Runs from a fresh Proxmox host through to a Talos service cluster. Each step depends on the previous — don’t skip out of order.

1. Create the homelab CA

cd tf/homelab-ca-base
terraform init -upgrade
terraform apply
cd -

2. Bootstrap the CA on its VM

SSH in as ansible (10.50.0.9) and cd ca:

./bootstrap.bash

3. Pull certs/keys to the local machine

mkdir -p /tmp/hl-ca-out
scp -r ansible@10.50.0.9:"/home/ansible/ca/out/*" /tmp/hl-ca-out

4. Inject the CA certs into the ansible vault

./scripts/update-ansible-vault-ca.bash ansible/vault.yaml \
  /tmp/hl-ca-out/muehlena_homelab_root_ca.crt \
  /tmp/hl-ca-out/vault_intermediate_ca.crt \
  /tmp/hl-ca-out/vault-unseal.services.homelab.muehlena.de.crt \
  /tmp/hl-ca-out/vault-unseal.services.homelab.muehlena.de.key

5. Deploy unseal-vault

Existing Proxmox + ansible work — see the playbook.

6. Copy the cloud-init Debian template

Used by Terraform when provisioning the cluster nodes.

7. Configure unseal-vault

ansible-playbook vault-unseal/install-and-update.yaml \
  -i inventory.yaml \
  -e "@./vault.yaml" \
  --vault-password-file ../.vault-pass -v

8. Set required Vault secrets

HTTPS secret, CA for unseal vault, and the unseal token:

./k8s/manifests/10-service-cluster/03-vault/create_secrets.bash \
  --create-token \
  --key /tmp/hl-ca-out/vault_combined.key \
  --crt /tmp/hl-ca-out/vault_combined.crt \
  --ca /tmp/hl-ca-out/muehlena_homelab_root_ca.crt

9. Export the kubeconfig path

export KUBECONFIG=$KUBECONFIG:$HOME/.kube/service-cluster

10. Provision the K8s service cluster

cd tf/service-cluster
terraform init -upgrade
terraform apply
cd -

Once the cluster is up, continue with Vault setup to move the auto-generated unseal keys to 1Password and configure static credentials.